This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

AppSecResearch2012

From OWASP
Jump to: navigation, search


AppsecResearch2012Banner.jpg

We are happy to announce that the OWASP Greek Chapter will be hosting the AppSec Research 2012 in Athens Greece

This conference is practically the OWASP AppSec Europe. Every two years we add “Research” in order to highlight that we invite both industry and academia to participate, share thoughts, knowledge and insight on application security.

OWASP AppSec Research is the European conference for anyone interested in application security

This year it will be hosted by the Department of Informatics and Telecommunications of the University of Athens, Greece and will take place between July 10-13th.

The first OWASP AppSec Research conference was held in Stockholm in 2010.


AppSec Research Conference Website



@appseceu Twitter Feed (follow us on Twitter!) <twitter>228539824</twitter>


The conference is expected to draw over 400 international attendees; all with budgets dedicated to web application security initiatives. Financial Services, Media, Pharmaceuticals, Government, Healthcare, Technology, and many other verticals will be represented.


Sponsorship Information can be downloaded here also you can find it online here



As part of AppSec Research 2012, on Wednesday, July 11 at 1:30PM-5:00PM, the Global Chapter Committee is organizing a chapter leader workshop for all the chapter leaders that attend the conference. Please note that this Workshop will take place on the day before the Conference starts.


Agenda

We plan to start with a 1.5 hour session run by experienced leaders (panel) on how to run a successful chapter. The second part of the workshop will be a roundtable discussion on regional issues and challenges, with a goal of working together to create solutions.


Are there other topics you would like to discuss? Please add them below:

  • Best practices of Chapter organization
  • How long should a leader lead a chapter?
  • Means of chapter fundraising and participation

Funding to Attend Workshop

If you need financial assistance to attend the Chapter Leader Workshop at AppSec Research, please submit a request to Josh Sokol and Sarah Baso by May 15, 2012.


Funding for your attendance to the workshop should be worked out in the following order.

  1. Ask your employer to fund your trip to AppSec Research in Athens, Greece.
  2. Utilize your chapter funds.
  3. Ask the chapter committee for funding assistance.


While we wish we could fund every chapter leader, due to the limited amount of budget allocated for this event, we may not be able to fund 100% to all the requests. Priority of sponsorships will be given to those not covered by a sponsorship to attend a workshop in 2011. Additionally, we are looking for new or struggling chapter leaders who need assistance kick starting their chapter.

After May 15, the Global Chapters Committee will make funding decision in a fair and transparent manner. When you apply for funding, please let us know why we should sponsor you. While we prefer that chapter leaders use their own chapter's funds before requesting a sponsorship, this is not a requirement for application. If your chapter has fund but will not be using them to sponsor your attendance, please include why you will not be using the funds for this purpose (i.e. what are the other plans for those funds?).


Participants

If you plan to attend, please fill in your name and chapter below:

  • Sarah Baso (OWASP Operational Support)
  • Tobias Glemser (OWASP German Chapter Leader)
  • Abbas Naderi Afooshteh (OWASP Iran Chapter Leader)
  • Ofer Shezaf (Founder and board member, Israeli chapter)
  • Seba Deleersnyder (OWASP Belgium Chapter founder and leader)
  • ...

Remote Participation

Join the Webinar Remotely

2011 Chapter Leader Workshops


Questions?

Contact us:
Josh Sokol, Chapters Committee Chair
Sarah Baso, OWASP Operational Support - Conference Logistics & Community Relations


The Call For Papers Is Now Closed!!!

Download Call for Papers in PDF format

OWASP AppSec Research 2012 July 10-13th, Athens, Greece

Aims and Scope The objective of OWASP AppSec Research 2012 is to discuss and demonstrate the importance of security risks, threats, and countermeasures in software applications. The majority of recent high-profile security breaches are mainly attributed to application-level vulnerabilities. Additionally, recent surveys indicate that government applications demonstrate increased vulnerabilities and at the same time elevated risk, as they store and process critical information such as PII, health information, national security data and furthermore operate critical systems. Traditionally, the focus of the security community has been mainly placed on the network perimeter, ignoring, to a large extent, the increased risk of insecure software. In addition, the proliferation of the use of web-based applications and services from traditional desktop-based browsers to mobile devices, or even the “cloud” has only increased the potential surface of attack and overall complexity. As a result, the challenges in the field of application security have only increased for those that build, test or defend software applications. OWASP AppSec Research focuses on new threats and vulnerabilities but also novel methodologies for testing and defending applications.

List of Topics We welcome the submission of both presentation proposals and research papers from the full spectrum of application security.

  • Application security
  • Security aspects of new/emerging web technologies/paradigms (mashups, web 2.0, offline support, etc)
  • Security in web services, XML, REST, and service oriented architectures
  • Security in cloud-based services
  • Security of development frameworks (Struts, Spring, ASP.Net MVC etc)
  • New security features in platforms or languages
  • Next-generation browser security
  • Security for the mobile web
  • Secure application development (methods, processes etc) and secure coding practices
  • Business risks of Application Security
  • Starting and Managing Secure Development Lifecycle Programs.
  • Privacy Concerns regarding applications and Data Storage
  • Threat modeling of applications
  • Vulnerability analysis and application security testing (code review, pentest, static analysis etc)
  • Countermeasures for application vulnerabilities
  • Metrics for application security
  • Application security awareness and education
  • Securing e-government applications and services
  • Government Initiatives & Case Studies
  • OWASP Tools and Projects
  • Anything else relating to OWASP and Application Security.

Important Dates Submission of papers by: April 15th, 2012 Notification of acceptance: May 18th, 2012 Camera-ready version of papers: June 3rd, 2012 Conference Dates July 12-13, 2012

Submissions

All papers and presentation/demo proposals should be submitted through:

http://www.easychair.org/conferences/?conf=appseceu2012

We accept the following types of submissions:

Presentation/Demo Proposals A presentation proposal should consist of a 2 page extended abstract representing the essential matter proposed by the speaker(s). Presentation slides and video takes will be posted on the OWASP wiki after the conference. A demo proposal should consist of a 1 page abstract summarizing the matter proposed by the speaker(s) and 1 page containing demo screenshot(s). Demos will have ordinary speaker slots but the speakers are expected to run a demo during the talk (live coding counts as a demo), not just a slideshow. Presentation slides and video takes will be posted on the OWASP wiki after the conference. Research Papers Authors are invited to submit original research papers offering novel contribution, written in English, with a very precise and concise presentation of no more than 12 pages in Springer LNCS style for "Proceedings and Other Multiauthor Volumes". Templates for preparing papers in this style for LaTeX, Word, etc can be downloaded from: http://www.springer.com/computer/lncs?SGWID=0-164-7-72376-0. Full papers must be submitted in a form suitable for anonymous review: remove author names and affiliations from the title page, and avoid explicit self-referencing in the text. Submission implies the willingness of at least one of the authors to register and present the paper. All papers will be anonymously reviewed by at least two members of the program committee. Full papers, presentation slides and video takes will be posted on the OWASP wiki after the conference.

Extended versions of the best research papers on the topic of “Security for E-Government Applications and Services” will be selected for publication on the Special Issue on “Security and Privacy of E-Government Applications and Services” of the International Journal of E-Government.

OWASP AppSec Research 2012 Co-Chairs Konstantinos Papapanagiotou, OWASP, Greece ([email protected]) Vasileios Vlachos, TEI of Larissa, Greece ([email protected])

OWASP AppSec Research 2012 Program Committee Yiorgos Adamopoulos, TEE, Greece Andreas Fuchsberger, Royal Holloway, UK Panagiotis Georgiadis, University of Athens, Greece Giles Hogben, ENISA, EU Christos Ilioudis, TEI of Thessaliniki, Greece Vassilis Katos, Democritus University of Thrace, Greece Emmanouel Kellinis, UK Angelos Keromytis, Columbia University, USA Athanasios Kostopoulos, independent researcher, Greece Harry Manifavas, TEI of Crete, Greece Dimitris Mitropoulos, Athens University of Economics and Business, Greece Alex Papanikolaou, TEI of Larissa, Greece Carlos Serrao, ISCTE, Portugal Stelios Tigkas, FortConsult, Denmark Costas Vassilakis, University of Peloponnese, Greece John Wilander, OWASP, Sweden


The Call For Trainers Is Now Closed!!!

OWASP is currently soliciting training providers for the OWASP AppSec Research 2012 conference that will take place at the Department of Informatics and Telecommunications, University of Athens, Greece on July 10th through 13th of 2012. There will be training courses on July 10th and 11th followed by plenary sessions on the 12th and 13th.

The following conditions apply for people or organizations that want to provide training at the conference:

   Training provider should provide class syllabus / training materials.
   Proceeds will be split 60/40 (OWASP/Trainer) for the training class.
   OWASP will provide the Venue, Marketing with Conference materials, Registration and basic AV
   Trainers will cover travel and accommodations for the instructor(s) and all course materials for students
   OWASP will reserve up to 2 training slots at no cost and the trainer may reserve up to one slot at no cost
   Price per attendee: 2-Day Class €990 / 1-Day Class €495.
   Trainers can brand training materials to increase their exposure
   Classes are to be focused around Application Security but are in no way limited to web application security.
   We will look favorably on laboration-based/hands-on training.

Submit proposals using the CFT template directly to [email protected] before March 30th 2012 to be considered. All trainers will be required to submit a Training Instructor Agreement in order to have their class scheduled.

Please forward to all interested practitioners and colleagues.

For information on keynotes please visit our site we will update this page as soon as all keynotes are booked

The conference will take place at the Department of Informatics and Telecommunications, University of Athens, Greece.

The Department of Informatics and Telecommunications is located in the University of Athens main campus, just a 15' walk from the Evangelismos metro station.

Additional travel information will be posted soon.


Greekchapterlogo.gif

Organizing Committee

  • Konstantinos Papapanagiotou (General Chair)
  • Panagiotis Georgiads (co-host)
  • Vasileios Vlachos (Vice-Chair)
  • Spyros Gasteratos
  • Stathis Mavrovouniotis
  • Emmanuel Kellinis
  • Stelios Tigkas

CFP Program Committee

  • Yiorgos Adamopoulos, TEE, Greece
  • Andreas Fuschberger, Royal Holloway, UK
  • Giles Hogben, ENISA, EU
  • Christos Ilioudis, TEI of Thessaliniki, Greece
  • Vassilis Katos, Democritus University of Thrace, Greece
  • Emmanouel Kellinis, UK
  • Angelos Keromytis, Columbia University, USA
  • Athanasios Kostopoulos, independent researcher
  • Harry Manifavas, TEI of Crete, Greece
  • Dimitris Mitropoulos, Athens University of Economics and Business, Greece
  • Alex Papanikolaou, TEI of Larissa, Greece
  • Carlos Serrao, ISCTE, Portugal
  • Stelios Tigkas, FortConsult, Denmark
  • Costas Vassilakis, University of Peloponnese, Greece
  • Vasileios Vlachos, TEI of Larissa, Greece
  • John Wilander, OWASP, Sweden


TimeTable

June 9th

Schedule

Conference Day 1 - June 9, 2011



Track 1 - Defend Track 2 - Prevent Track 3 - Attack
0800-08:50 Registration and Breakfast + Coffee
08:50-09:00 Welcome by AppSec EU Board
09:00-10:00 Keynote: Brad Arkin, Adobe Corp | SLIDES
10:00-10:30 OWASP Global Board Update - Tom Brennan, Eoin Keary, Seba Deleersnyder
10:30-10:45 Coffee Break
10:45-11:30 Practical Browser Sandboxing on Windows with Chromium, Tom Keetch, Verizon Business
SLIDES
Building a Robust Security Plan, Narainder Chandwani, Foundstone
SLIDES
APT in a Nutshell, "David Stubley, 7 Elements Ltd"
SLIDES
11:30-11:40 Break
11:40-12:25 How to become Twitter's admin: An introduction to Modern Web Service Attacks, Andreas Falkenberg, RUB
SLIDES


The missing link: Turning Securable apps into secure installations using SCAP, Charles Schmidt, MITRE Corp.
SLIDES


The Buzz about Fuzz: An enhanced approach to finding vulnerabilities, Joe Basirico, Security Innovation
SLIDES
12:25-13:25 Lunch
13:25-14:25 Keynote: Giles Hogben, ENISA | SLIDES
14:25-14:40 Break
14:40-15:25 OWASP Secure Coding Practices Quick Reference Guide, Keith Turpin, The Boeing Company
SLIDES
Integrating security testing into a SDLC: what we learned and have the scars to prove it, Mark Crosbie, IBM
SLIDES
Intranet Footprinting: Discovering Resources from outside, Javier Marcos de Prado & Juan Galiana Lara, IBM
SLIDES
15:25-15:40 Coffee Break
15:40-16:25 Building Large Scale Detectors for Web-based Malware, Marco Balduzzi & Davide Canali, EURECOM
SLIDES
Infosec Stats: Reading between the lines, Chris Eng, Veracode
SLIDES
Python Basics for Web App Pentesters, Justin Searle, InGuardians Inc
SLIDES
16:25-16:35 Break
16:35-17:20 OWASP AppSensor Project, Colin Watson, Watson Hall Ltd
SLIDES
A buffer overflow Story: From Responsible Disclosure to Closure, Douglas Held, Fortify (HP)
SLIDES
CTF: Bringing back more than sexy!, Mark Hillick, KTF
SLIDES
19:00-23:00 Networking Event - Drinks at the Church Bar


June 10th

Schedule

Conference Day 2 - June 10, 2011



Track 1 - Defend Track 2 - Prevent Track 3 - Attack
08:00-08:50 Registration
08:50-09:00 Day 2 Opening Remarks
09:00-10:00 Keynote: Janne Uusilehto, Nokia | SLIDES
10:00-10:10 Break
10:10-10:55 Software Security: Is OK Good Enough?, John Dickson, Denim Group Ltd.
SLIDES
An Overview of Threat Modeling, Paco Hope, Cigital Inc.
SLIDES
An Introduction to the OWASP Zed Attack Proxy, "Simon Bennetts, OWASP"
SLIDES
10:55-11:10 Coffee Break
11:10-11:55 New standards and upcoming technologies in browser security, Tobias Gondrom, IETF WG
SLIDES


Simple Approach to Sepcifying Security Requirements for Online Developments, Alexis Fitzgerald, RITS
SLIDES


A Case Study on Enterprise E-mail (in) Security Solutions, Marian Ventuneac, Genworth Financial
SLIDES
11:55-12:05 Break
12:05-12:50 Empty Slot


A Critical Look at the Classification Schemes for Privacy Risks, Elke Roth-Mandutz and Georg Simon, Ohm University
SLIDES


Testing Security Testing: Evaluating Quality of Security Testing, Ofer Maor, Seeker Security
SLIDES
12:50-13:50 Lunch
13:50-14:50 Keynote: Alex Lucas, Microsoft | SLIDES
14:50-15:00 Break
15:00-15:45 Putting the Smart into Smartphones: Security Testing Mobile Applications, Dan Cornell, Denim Group
SLIDES
Wordpress Security, Steve Lord, Mandalorian Security Ltd.
The Dark Side: Measuring and Analyzing Malicious Activity On Twitter, Daniel Peck, Barracuda Networks
SLIDES
15:45-16:00 Coffee Break
16:00-16:45 Threat modeling of banking malware-based attacks using the P.A.S.T.A. framework, Marco Morana, Cincinnati Chapter Lead & Tony UcedaVelez, VerSprite
SLIDES
PCI DSS v2.0: a new challenge for web application security testing?, Laurent Benameur Sauvaire, Espion, Ltd.
Practical Crypto Attacks Against Web Applications, Justin Clarke, Gotham Digital Science
SLIDES
16:45-16:55 Break
16:55-17:40 Keynote: Arian Evans, Whitehat Security
17:40-18:00 Conference Closure and Raffle


Contributions

The AppSec Research Conference Website's artwork was made by Mis Thaleia V. Mis Marianna Preen is the person who designed the icons